https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T08:40:47.002083+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-72538 fkie_cve-2026-72538 2026-09-29T08:40:49.177142+00:00

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.

 https://vulnerability.circl.lu/vuln/ghsa-42fh-94w4-956q GHSA-42fh-94w4-956q 2026-09-29T08:40:49.177375+00:00

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.